Privilege Escalation
Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user.
Types of Privilege Escalation
Vertical Privilege Escalation (Privilege Gain)
Gaining higher privileges than currently held — for example, a standard user obtaining administrator or root access on a system.
Horizontal Privilege Escalation (Access Gain)
Accessing resources or functionality belonging to another user with the same privilege level — for example, accessing another user's account or data.
Common Techniques
On Windows
- Token Manipulation: Impersonating access tokens of higher-privileged processes
- UAC Bypass: Circumventing User Account Control mechanisms
- Service Exploitation: Abusing misconfigured Windows services with weak permissions
- DLL Hijacking: Placing malicious DLLs in locations where privileged processes load them
- Kernel Exploits: Exploiting vulnerabilities in the Windows kernel
On Linux
- SUID/SGID Abuse: Exploiting setuid/setgid binaries with elevated permissions
- Sudo Misconfigurations: Abusing overly permissive sudo rules
- Kernel Exploits: Exploiting Linux kernel vulnerabilities (Dirty Pipe, Dirty COW)
- Cron Job Abuse: Modifying cron scripts that run as root
- Wildcard Injection: Exploiting wildcards in shell commands
Why It Matters
Initial access often provides limited privileges. Attackers must escalate privileges to install persistent backdoors, access sensitive data, disable security tools, or move laterally to other systems. Privilege escalation is a critical step in nearly every successful attack chain.
Detection Strategies
- Monitor for unusual process-to-process creation relationships
- Alert on sensitive group membership changes (adding users to admin groups)
- Track use of privilege escalation tools and techniques
- Monitor for exploitation of known privilege escalation vulnerabilities
- Implement application whitelisting and least-privilege policies
Mitigation
- Apply patches promptly, especially for known privilege escalation vulnerabilities
- Implement least-privilege access for all users and services
- Use privileged access management (PAM) solutions
- Harden operating system configurations (CIS Benchmarks)
- Monitor and audit privileged account usage
Related Terms
- Lateral Movement
- Initial Access
- Credential Harvesting
